CLAIMS 

1 . A method of protecting a file, comprising: 
requesting access to a file; 

accessing a vnode associated with the file; and 
5 executing a substitute routine associated with the vnode. 

2. The method of claim 1 , wherein the substitute routine is associated with the 
request. 

3. The method of claim 1, wherein the vnode is a modified vnode. 

4. The method of claim 1, wherein executing includes protecting the file. 

10 5. The method of claim 1 , wherein executing includes blocking access to the file. 

6. The method of claim 1, wherein executing includes blocking write access to the 
file. 

7. The method of claim 1, wherein the vnode is associated with a substitute 
operations vector associated with the substitute routine. 

15 8. The method of claim 1 , wherein the vnode includes a pointer that points to a 
substitute operations vector associated with the substitute routine. 

9. The method of claim 1 , wherein the vnode includes a pointer that points to a 
substitute operations vector that calls the substitute routine. 

10. The method of claim 1, further comprising configuring the file for protection. 
20 11. The method of claim 10, wherein configuring includes: 

accessing the vnode associated with the file; and 
modifying the vnode. 
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12. The method of claim 1, further comprising: 
determining an operation to be protected; and 

modifying in the vnode a routine associated with the operation. 

13. The method of claim 1, further comprising holding the vnode in memory. 

5 14. The method of claim 1, further comprising saving an original operations vector. 

15. The method of claim 1, further comprising: 
determining whether the file exists; 

providing notification when the file is created if the file does not exist. 

16. The method of claim 1, further comprising configuring the file for protection prior 
10 to runtime. 

17. The method of claim 1, further comprising: 
modifying the vnode. 

18. The method of claim 1, further comprising: 
associating the vnode with a substitute routine. 

15 19. The method of claim 1, further comprising: 

associating the vnode with a substitute operations vector associated with a 
substitute routine. 

20. The method of claim 1, further comprising: 

modifying a pointer associated with the vnode to point to a substitute operations 
20 vector associated with a substitute routine. 

2 1 . The method of claim 1 , further comprising: 

modifying a pointer associated with the vnode to point to a substitute operations 
vector that calls a substitute routine. 
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22. The method of claim 1, further comprising removing protection of the file. 

23. The method of claim 22, wherein removing includes: 
accessing the vnode associated with the file; and 
modifying the vnode. 

24. The method of claim 1, further comprising releasing a hold on the vnode. 

25. The method of claim 1, further comprising: 
associating the vnode with an original routine. 

26. The method of claim 1, further comprising: 

associating the vnode with an original operations vector associated with an 
original routine. 

27. The method of claim 1, wherein the vnode is a vnode in a UNIX system. 

28. The method of claim 1, wherein the vnode is an inode in a Linux system. 

29. A system for protecting a file, comprising a processor and memory configured to: 
request access to a file; 

access a vnode associated with the file; and 

execute a substitute routine associated with the vnode. 

30. A computer program product for protecting a file, the computer program product 
being embodied in a computer readable medium and comprising computer instructions 
for: 

requesting access to a file; 

accessing a vnode associated with the file; and 

executing a substitute routine associated with the vnode. 
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